user controller finds user by accesstoken